In the prior art, as a traffic analyzing method, a method has been proposed in which concern index values are assigned to flows between hosts on a network, and an alarm is issued if the accumulated concern index values exceed a threshold value (see U.S. Pat. No. 7,475,426 and U.S. Pat. No. 7,185,368).